@ai-sdk/provider-utils 5.0.46 → 5.0.49

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-sdk/provider-utils",
-  "version": "5.0.46",
+  "version": "5.0.49",
   "type": "module",
   "license": "Apache-2.0",
   "sideEffects": false,

package/src/combine-headers.ts

@@ -4,7 +4,7 @@ export function combineHeaders(
   return headers.reduce(
     (combinedHeaders, currentHeaders) => ({
       ...combinedHeaders,
-      ...(currentHeaders ?? {}),
+      ...currentHeaders,
     }),
     {},
   ) as Record<string, string | undefined>;

package/src/delay.ts

@@ -12,7 +12,7 @@ export async function delay(
   },
 ): Promise<void> {
   if (delayInMs == null) {
-    return Promise.resolve();
+    return;
   }
 
   const signal = options?.abortSignal;

package/src/detect-media-type.ts

@@ -299,8 +299,6 @@ function detectMediaTypeBySignatures<T extends MediaTypeSignatures>({
       return signature.mediaType;
     }
   }
-
-  return undefined;
 }
 
 const topLevelSignatureTables = {

package/src/download-blob.ts

@@ -1,6 +1,6 @@
 import { cancelResponseBody } from './cancel-response-body';
 import { DownloadError } from './download-error';
-import { fetchWithValidatedRedirects } from './fetch-with-validated-redirects';
+import { fetchUntrustedUrl } from './fetch-untrusted-url';
 import {
   readResponseWithSizeLimit,
   DEFAULT_MAX_DOWNLOAD_SIZE,
@@ -22,7 +22,7 @@ export async function downloadBlob(
   options?: { maxBytes?: number; abortSignal?: AbortSignal },
 ): Promise<Blob> {
   try {
-    const response = await fetchWithValidatedRedirects({
+    const response = await fetchUntrustedUrl({
       url,
       abortSignal: options?.abortSignal,
     });

package/src/embedding-model-capabilities.ts

@@ -1,3 +1,5 @@
+import type { SharedV4ProviderOptions } from '@ai-sdk/provider';
+
 /**
  * Symbol for exposing the UTF-8 input byte budget of an embedding model.
  *
@@ -7,3 +9,24 @@
 export const EMBEDDING_MODEL_MAX_INPUT_BYTES_PER_CALL = Symbol.for(
   'vercel.ai.embeddingModel.maxInputBytesPerCall',
 );
+
+/**
+ * Symbol for transforming provider options for an automatically batched
+ * embedding model call.
+ *
+ * This capability is experimental and intentionally lives outside the versioned
+ * embedding model specification.
+ */
+export const EMBEDDING_MODEL_PROVIDER_OPTIONS_TRANSFORMER = Symbol.for(
+  'vercel.ai.embeddingModel.providerOptionsTransformer',
+);
+
+export type EmbeddingModelProviderOptionsTransformer = (options: {
+  providerOptions: SharedV4ProviderOptions | undefined;
+  values: Array<string>;
+  startIndex: number;
+  endIndex: number;
+}) =>
+  | SharedV4ProviderOptions
+  | undefined
+  | PromiseLike<SharedV4ProviderOptions | undefined>;

package/src/fetch-untrusted-url.ts

@@ -0,0 +1,86 @@
+import { fetchWithValidatedRedirects } from './fetch-with-validated-redirects';
+import { isSameOrigin } from './is-same-origin';
+import { sanitizeRequestHeaders } from './sanitize-request-headers';
+
+// Providers can use arbitrary credential header names. Only established
+// non-credential request metadata is safe to forward without an origin assertion.
+const SAFE_UNTRUSTED_FIRST_HOP_HEADERS = new Set([
+  'accept',
+  'accept-language',
+  'baggage',
+  'cache-control',
+  'idempotency-key',
+  'if-match',
+  'if-modified-since',
+  'if-none-match',
+  'if-range',
+  'if-unmodified-since',
+  'pragma',
+  'range',
+  'traceparent',
+  'tracestate',
+  'user-agent',
+  'x-correlation-id',
+  'x-request-id',
+]);
+
+/**
+ * Fetches an untrusted URL with first-hop credential isolation and validated
+ * redirects. Uses the URL validation, DNS-pinned Node.js transport, redirect
+ * limits, and cross-origin header stripping of {@link fetchWithValidatedRedirects}.
+ * An injected fetch must provide equivalent connect-time DNS validation.
+ *
+ * Without a matching `credentialedOrigin` (or `trustedOrigin` when it is
+ * omitted), only allowlisted request metadata is sent on the first hop.
+ * Arbitrary caller headers require an explicit matching origin because vendor
+ * credential names cannot be inferred safely. Proxy, metadata, cookie, and
+ * hop-by-hop headers are sanitized even for a matching origin.
+ *
+ * `trustedOrigin` also exempts same-origin hops from URL validation, allowing
+ * developer-configured private endpoints. Both origin options must come from
+ * developer configuration, never from untrusted response data.
+ *
+ * This is an opt-in alternative to `fetchWithValidatedRedirects`, whose
+ * existing first-hop header behavior is preserved for compatibility.
+ */
+export async function fetchUntrustedUrl({
+  headers,
+  credentialedOrigin,
+  untrustedFirstHopHeaders,
+  ...options
+}: Parameters<typeof fetchWithValidatedRedirects>[0] & {
+  /**
+   * The developer-configured origin allowed to receive arbitrary caller
+   * headers on the first hop. Defaults to `trustedOrigin` when omitted.
+   * An explicit value takes precedence over `trustedOrigin` and does not
+   * exempt the URL from validation.
+   */
+  credentialedOrigin?: string;
+  /**
+   * Additional sanitized header names safe to disclose to an untrusted first
+   * hop. Use only for non-credential protocol metadata. Credentials require
+   * a matching `credentialedOrigin` instead. Names are case-insensitive.
+   */
+  untrustedFirstHopHeaders?: readonly string[];
+}): Promise<Response> {
+  let firstHopHeaders: Headers | undefined;
+  if (headers !== undefined) {
+    firstHopHeaders = sanitizeRequestHeaders(headers);
+    const origin = credentialedOrigin ?? options.trustedOrigin;
+
+    if (origin === undefined || !isSameOrigin(options.url, origin)) {
+      const allowedHeaders = new Set([
+        ...SAFE_UNTRUSTED_FIRST_HOP_HEADERS,
+        ...(untrustedFirstHopHeaders ?? []).map(name => name.toLowerCase()),
+      ]);
+      firstHopHeaders = new Headers(
+        [...firstHopHeaders].filter(([name]) => allowedHeaders.has(name)),
+      );
+    }
+  }
+
+  return fetchWithValidatedRedirects({
+    ...options,
+    headers: firstHopHeaders,
+  });
+}

package/src/fetch-with-validated-redirects.ts

@@ -83,6 +83,9 @@ export async function fetchWithValidatedEndpoint({
  * Request headers are also protected: {@link sanitizeRequestHeaders} strips
  * proxy/metadata/cookie/hop-by-hop headers before the first request, and all
  * caller headers except `User-Agent` are dropped on a cross-origin redirect.
+ * Credentials and custom headers are preserved on the first hop for backwards
+ * compatibility. The caller must ensure that the initial URL may receive them.
+ * Use `fetchUntrustedUrl` for URLs that require first-hop credential isolation.
  * The fetch spec only strips `Authorization` on cross-origin redirects because
  * in a browser, CORS preflighting protects custom headers; there is no CORS on
  * the server, so provider API keys carried in custom headers (e.g. `x-key`)

package/src/handle-fetch-error.ts

@@ -36,8 +36,6 @@ function findNetworkError(
 
     current = (current as Error & { cause?: unknown }).cause;
   }
-
-  return undefined;
 }
 
 export function handleFetchError({

package/src/index.ts

@@ -30,7 +30,11 @@ export {
 } from './detect-media-type';
 export { downloadBlob } from './download-blob';
 export { DownloadError } from './download-error';
-export { EMBEDDING_MODEL_MAX_INPUT_BYTES_PER_CALL as EXPERIMENTAL_EMBEDDING_MODEL_MAX_INPUT_BYTES_PER_CALL } from './embedding-model-capabilities';
+export {
+  EMBEDDING_MODEL_MAX_INPUT_BYTES_PER_CALL as EXPERIMENTAL_EMBEDDING_MODEL_MAX_INPUT_BYTES_PER_CALL,
+  EMBEDDING_MODEL_PROVIDER_OPTIONS_TRANSFORMER as EXPERIMENTAL_EMBEDDING_MODEL_PROVIDER_OPTIONS_TRANSFORMER,
+  type EmbeddingModelProviderOptionsTransformer,
+} from './embedding-model-capabilities';
 export {
   fetchWithValidatedEndpoint,
   fetchWithValidatedRedirects,
@@ -38,6 +42,7 @@ export {
 export { extractLines } from './extract-lines';
 export * from './extract-response-headers';
 export * from './fetch-function';
+export { fetchUntrustedUrl } from './fetch-untrusted-url';
 export { filterNullable } from './filter-nullable';
 export { createIdGenerator, generateId, type IdGenerator } from './generate-id';
 export * from './get-error-message';

package/src/is-url-supported.ts

@@ -1,11 +1,11 @@
 /**
  * Checks if the given URL is supported natively by the model.
  *
- * @param mediaType - The media type of the URL. Case-sensitive. May be a full
+ * @param mediaType - The media type of the URL. Case-insensitive. May be a full
  *                    `type/subtype`, a wildcard `type/*`, or just the
  *                    top-level segment (e.g. `image`).
  * @param url - The URL to check.
- * @param supportedUrls - A record where keys are case-sensitive media types (or '*')
+ * @param supportedUrls - A record where keys are case-insensitive media types (or '*')
  *                        and values are arrays of RegExp patterns for URLs.
  *
  * @returns `true` if the URL matches a pattern under the specific media type
@@ -46,7 +46,9 @@ export function isUrlSupported({
         if (isTopLevelOnly) {
           return `${mediaType}/` === mediaTypePrefix;
         }
-        return mediaType.startsWith(mediaTypePrefix);
+        return mediaTypePrefix.endsWith('/')
+          ? mediaType.startsWith(mediaTypePrefix)
+          : mediaType === mediaTypePrefix;
       })
       .flatMap(({ regexes }) => regexes)
       // check if any pattern matches the url:

package/src/normalize-batch-request-counts.ts

@@ -31,8 +31,6 @@ export function normalizeBatchRequestCounts({
       failed,
     };
   }
-
-  return undefined;
 }
 
 function isNonNegativeSafeInteger(

package/src/resolve.ts

@@ -28,5 +28,5 @@ export async function resolve<T>(value: Resolvable<T>): Promise<T> {
   }
 
   // Otherwise just resolve whatever we got (value or promise)
-  return Promise.resolve(value as T);
+  return value as T;
 }

package/src/sanitize-request-headers.ts

@@ -4,9 +4,11 @@
  * transport headers (RFC 7230 §6.1).
  *
  * `Authorization` and other credential-bearing caller headers (e.g. `x-key`)
- * are intentionally not listed — they're needed on the first hop of some
- * provider polling calls. Instead, all caller headers except the user-agent are
- * dropped on a cross-origin redirect (see `fetch-with-validated-redirects`).
+ * are intentionally not listed because trusted provider requests may need
+ * them. `fetchUntrustedUrl` separately restricts an untrusted first hop to an
+ * explicit allowlist of non-credential request metadata. Both it and
+ * `fetchWithValidatedRedirects` drop all caller headers except the user-agent
+ * on a cross-origin redirect.
  */
 const BLOCKED_REQUEST_HEADERS: readonly string[] = [
   // Hop-by-hop / transport (RFC 7230 §6.1)

package/src/to-json-schema/zod3-to-json-schema/parsers/string.ts

@@ -20,7 +20,7 @@ export const zodPatterns = {
    * `a-z` was added to replicate /i flag
    */
   email:
-    /^(?!\.)(?!.*\.\.)([a-zA-Z0-9_'+\-\.]*)[a-zA-Z0-9_+-]@([a-zA-Z0-9][a-zA-Z0-9\-]*\.)+[a-zA-Z]{2,}$/,
+    /^(?!\.)(?!.*\.\.)([a-zA-Z0-9_'+\-.]*)[a-zA-Z0-9_+-]@([a-zA-Z0-9][a-zA-Z0-9-]*\.)+[a-zA-Z]{2,}$/,
   /**
    * Constructed a valid Unicode RegExp
    *

package/src/types/tool-approval-request.ts

@@ -31,4 +31,12 @@ export type ToolApprovalRequest = {
    * Present only when `experimental_toolApprovalSecret` is configured.
    */
   signature?: string;
+
+  /**
+   * Tool input before input schema validation and transformation.
+   *
+   * This is included when it differs from the validated tool input so that
+   * approved tool calls can be safely revalidated before execution.
+   */
+  inputSchemaInput?: unknown;
 };

package/src/validate-download-url.ts

@@ -78,7 +78,6 @@ export function validateDownloadUrl(url: string): void {
         message: `URL with IP address ${hostname} is not allowed`,
       });
     }
-    return;
   }
 }